Hello and welcome back.
We are now going to start dynamic analysis using the same dynamic analysis workflow which we have used
before, and we are going to do it on financial unpack.
So the first thing we do is to attack the problem on.
So we're down here, click on the problem on program and then.
We are going to to.
And are going to clear the output.
Next thing, we are going to start faking it, so click on faking it down here and then you can.
They never intersect on the network traffic.
Which team are they generating?
Next, we are going to do the right shot, so we just click allow access.
And now we open the shot to.
From utilities.
He.
And yet here on the chamber and chief directory to see the root of the system and click on for Farshad.
One shot, and this will take a few minutes, so I'll post the video and come back when it is 10.
Now, he has finished the fourth shot.
You can see the message popping up here, you can click OK, and before we take a second shot, we need
to run the the melee itself.
And we know that you never.
So these two runners going up if elevated privilege, because we saw from your data analysis, it is
trying to right trouble in those locations, which is a protected foda.
So we need to run as administrator so they can do his thing.
So we go back to the way and run the speculation at him, etc..
But before we do that, we need to start the process monitor.
So we click on capture and process monitor and then we go to the Malvasia rightly.
And then he rang and Australia.
Yes.
And immediately you see this fake message popping up, your virus is infected.
I mean, this has detected Spyro infection.
It is recommended to you special anti spyware tools to prevent the loss and so on.
And he wants you to do something.
And we saw this message when we were doing the study analysis earlier and also, in effect, that he
received some activity going on.
And here you will see.
He's trying to connect to the Internet and download something from the Internet, from this website,
download British Century to Come.
So this is a server is trying to connect you to download additional packages.
So we just let it run for about maybe a minute and then keep an eye on this thing that you see additional
additional activity going up to the network.
And you can see now on the monitor is capturing the events.
Up to thirty three thousand eighty eighty seven thousand now an event has been captured.
They tell you, and then I see the output and we see whether or not he drops this far in this location,
as indicated by our static analysis.
So far, it is not showing how showing any additional activity on the network.
OK, I think we can stop this process monitor now so we can stop it by clicking this icon here, and
after we stop the process monitor, we are going to go back to Russia and take our second shot.
So we head back to Russia and now click on second shot.
And I said I shot.
And it should be relatively faster than the first shot.
And the second shot is now complete, as you can see, the message has popped up and you can click on
that.
Now we are going to click on the compare button and select compare and put.
And this will take a little bit longer than the second shot, so I'm going to pass the video, come
back here.
Who has done the comparison?
The comparison is completed and now he has popped up this year to Texas and let's start analyzing and
from here we see that there are certain values added.
And here we see this one.
A new KIA has been created in this registry, and the name is called Windows Abdelillah.
And Evalu is this part of this file.
So sure enough, this is a persistance mechanism for this malware.
So it is going to run this new file, which has dropped into this location, C windows, and the file
is expanded.
So whenever somebody reboots the computer or locks off and reloading, it is going to run this and drop
the file here.
And surprisingly, there is a second persistance mechanism here.
It has also created a new key, cauchon in the same location as the first key halfwits registry location.
And this time it is calling itself.
So we have to persistance mechanism.
Now, let's go see if there's anything else.
Nothing suspicious or interesting here.
And the Farsad and you can see that he has created to file charges, dropped two files.
One is install that in this location, uses PCR data roaming so we can copy this out and put it in its
original notes.
And then the second one is expanded, which we already did when we did the static analysis earlier and
saw the same day as well above.
So these are two new files in the edit.
And so those are the indicators of compromise which has revealed.
So now let's move on to Propman and you are going to prepare Propman.
OK, for a spot, but before then, we need to apply some filters because at the moment we have 89000
hits.
All right.
So to do the filters, we will continue in the next video.
Thank you for watching.